NSA’s 2027 PQC Rule Turns “Capable” Into a Procurement Test
NSA’s new PQC measures require new commercial National Security Systems to support quantum-resistant algorithms in 2027 and phase out incapable legacy systems…
Vista Insights
Cryptography is becoming an operating discipline.
Practical analysis for leaders building cryptographic visibility, sequencing post-quantum migration, governing risk, and producing evidence that stands up to scrutiny.
The library
PQC migration insights
Analysis, field notes, and product thinking for this topic.
-
-
Cloudflare’s MTC Plan Makes Transparency Part of Post-Quantum Trust
Cloudflare’s planned post-quantum certificate authority shows why WebPKI migration must govern issuance logs, mirrors, client landmarks, fallback paths, and certificate policy.
-
NATO’s Quantum Roadmap Makes PQC an Interoperability Program
NATO’s new Quantum Technology Roadmap puts post-quantum cryptography inside a broader program of standards, pilots, industry readiness, and allied interoperability.
-
X-Wing Shows Why Hybrid Cryptography Must Be Tracked as One Dependency
The latest X-Wing draft combines X25519 and ML-KEM-768, illustrating why hybrid cryptography needs exact names, versions, implementations, and use-context records.
-
PQC for Enterprise Wi-Fi Is an Onboarding and Trust-Anchor Project
A new IETF draft shows that post-quantum EAP-TLS affects certificates, device onboarding, trust anchors, and wireless reliability—not just cipher selection.
-
Ethereum’s PQC Roadmap Shows Why One Migration Needs Four Inventories
Ethereum’s updated quantum-resistance roadmap separates consensus signatures, data commitments, account signatures, and application proof systems. That decomposition is a useful model for…
-
Java 27 Makes Hybrid PQC TLS a Runtime Inventory Question
Java 27 adds default-preferred hybrid ML-KEM key exchange for TLS 1.3. Organizations still need runtime, configuration, peer, and observed-session evidence before claiming…
-
RFC 10033 Makes Backup State Part of Post-Quantum Signature Security
Stateful hash-based signatures can fail if a one-time signing key is reused. RFC 10033 shows why backups, VM cloning, concurrency, capacity, and…
-
A Draft ACME PQC Profile Asks Who Sets Certificate Policy
A new individual Internet-Draft proposes PQC posture fields for ACME certificate orders. It is not a standard, but it raises useful questions…
-
Post-Quantum DNSSEC Has a Packet-Size Problem—and a Trust-Chain Problem
Cloudflare now validates ML-DSA-44 DNSSEC signatures on 1.1.1.1. The deployment exposes transport, downgrade, and delegation-chain questions that every DNS operator should test.